How can escaping certain characters help prevent vulnerabilities in PHP code?

Escaping certain characters in PHP code helps prevent vulnerabilities such as SQL injection and cross-site scripting attacks. By escaping characters, you are ensuring that user input is treated as data rather than executable code, reducing the risk of malicious code being injected into your application.

$user_input = $_POST['user_input'];
$escaped_input = mysqli_real_escape_string($connection, $user_input);
$query = "SELECT * FROM users WHERE username='$escaped_input'";
$result = mysqli_query($connection, $query);